On this page · 13 sections
- What changed for 2026 and 2027
- What US and UK buyers actually ask for
- Cyber Essentials and Cyber Essentials Plus
- ISO/IEC 27001:2022
- SOC 2
- Head-to-head comparison
- How the controls overlap
- Decision table: which to pick
- Worked cost example: a 40-person SaaS vendor selling in both markets
- Implementation checklist
- How buyers should read supplier evidence
- How eCorpIT can help
- References
Summary. The three schemes produce different evidence for different buyers. Cyber Essentials is the UK government-backed certificate for five technical controls; under PPN 014, UK central government and NHS bodies require it, Cyber Essentials Plus or equivalent controls for contracts handling personal data or OFFICIAL-level ICT. IASME lists £320 to £600 + VAT ($460 to $850) by headcount, and assessments opened after 26 April 2026 fail outright without MFA on every cloud service that offers it, or if critical and high-risk patches take over 14 days. ISO/IEC 27001:2022 certifies an information security management system; ISO certifies nobody itself, and 2013-edition certificates had to expire or be withdrawn by 31 October 2025. SOC 2 is an attestation report by a licensed CPA firm. The AICPA's draft 2027 criteria are open for comment until 15 January 2027 and proposed for engagements beginning on or after 31 December 2027. Neither ISO nor the AICPA publishes audit fees. Our verdict: UK public-sector bids need Cyber Essentials first, US enterprise SaaS sales need SOC 2, and multinational or EU buyers add ISO 27001.
About this article. For founders, security and sales leads at software companies selling to US and UK buyers. On 12 November 2026 we checked rules, prices and dates against NCSC, IASME, GOV.UK, ISO, IAF, Global ACI, AICPA and FedRAMP pages, plus audit firms' material where AICPA documents sit behind a login. General information, not legal or procurement advice; fees change. eCorpIT holds ISO/IEC 27001:2022 certification and sells readiness engineering for these frameworks; no certification body or audit firm paid for inclusion. Researched with AI assistance and reviewed by our editorial team.
What changed for 2026 and 2027
Cyber Essentials got stricter. The NCSC's Requirements for IT Infrastructure v3.3 took effect on 27 April 2026. IASME said the matching Danzell question set would be published on 13 February 2026, and that for assessment accounts created after 26 April 2026, missing MFA on a cloud service (whether MFA is free, included or paid) and late critical or high-risk patches are automatic failures. Cloud services cannot be excluded from scope, and every in-scope legal entity is shown on the digital certificate. Our Cyber Essentials Danzell explainer covers the detail.
ISO 27001:2013 is gone, and the IAF has a successor. IAF MD 26 required certification bodies to move certified clients to ISO/IEC 27001:2022 by 31 October 2025; all 2013-edition certifications expire or are withdrawn at the end of the transition. Since 1 January 2026, Global ACI has taken over the former roles of the IAF and ILAC, including the international recognition arrangement for accredited certificates.
SOC 2 criteria are being rewritten. The AICPA's Assurance Services Executive Committee issued exposure drafts of proposed 2027 Trust Services Criteria and Description Criteria; the resource page is dated 26 October 2026. Comments are due by 15 January 2027. If approved, the criteria would apply to engagements beginning on or after 31 December 2027, with early adoption permitted.
Fast SOC 2 reports are under scrutiny. A May 2026 alert from the AICPA's Peer Review Board tells peer reviewers to look for SOC 2 engagements with identical reports, risk assessments, sample sizes and testing across clients, which peer review treats as nonconforming. The AICPA's SOC page also notes it is looking into anonymously published allegations about a compliance vendor that offers SOC services.
Cyber Essentials got cheaper. A DCMS funding package published on 3 November 2026 gives SMEs 75% off a new certificate through the First Step Fund until the end of March 2027 or until funding runs out. Cyber Resilience Pledge signatories can nominate SME suppliers for fully funded certification until the end of March 2029.
What US and UK buyers actually ask for
UK public sector and UK supply chains
The governing note is PPN 014, published by the Cabinet Office on 17 February 2025. It replaces PPN 09/14 and PPN 09/23 for procurements under the Procurement Act 2023, which covers procurements commenced on or after 24 February 2025. The requirement dates from PPN 09/14, which covered central government contracts advertised after 1 October 2014.
PPN 014 applies to central government departments, their executive agencies and non-departmental public bodies, and NHS bodies. Where a supplier will handle citizens' or government staff's personal information, or supply ICT that stores or processes OFFICIAL data, these bodies must require Cyber Essentials, Cyber Essentials Plus or equivalent controls, renewed yearly for the life of the contract and in place before data is passed over. The note also tells buyers not to demand it on every contract by default.
PPN 014 also says an ISO 27001 certificate does not automatically meet Cyber Essentials, because the five controls are rarely all in an ISO scope or tested. And under section 56 of the Procurement Act 2023, in-scope buyers must accept genuine equivalents.
Outside government, the NCSC's Supply Chain Playbook of 12 December 2025 asks large organisations to require Cyber Essentials across their supply chains, and a growing number do. Our US and UK compliance calendar for 2027 lists other dates software teams face.
US enterprise buyers
For SaaS and other service providers, the US default is a SOC 2 report. The AICPA's Journal of Accountancy describes SOC 2 reports as central to third-party risk management, with demand still growing. Some accept ISO 27001 instead, so ask each prospect before paying for both.
US federal work sits outside all three. Cloud services sold to federal agencies go through FedRAMP, whose marketplace counted 557 certified services on 12 November 2026. Defence contractors face the Department of Defense's CMMC programme, whose rule took effect on 16 December 2024.
International and EU buyers
ISO 27001 travels furthest. Global ACI says accreditations granted under the multilateral arrangement it inherited from the IAF can be recognised worldwide. That is why multinational procurement teams often ask for ISO 27001 even when they accept SOC 2. EU buyers of software products also face new product security law; see our Cyber Resilience Act guide.
Cyber Essentials and Cyber Essentials Plus
What it is. A UK government-backed certification against five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. The NCSC sets the requirements; IASME, its delivery partner, manages a network of more than 400 organisations that advise and certify.
Two levels. Basic Cyber Essentials is a verified self-assessment: a board member or equivalent signs off the answers and an assessor marks them. Cyber Essentials Plus adds a technical audit of a representative set of user devices, all internet gateways and all servers with internet-facing services. If your basic certificate is less than three months old when you certify to Plus, IASME says you do not repeat the self-assessment.
Scope. The whole IT infrastructure or a well-defined, separately managed subset. A scope without end-user devices is not acceptable, and cloud services cannot be excluded. All in-scope software must be licensed and supported, and updates fixing critical or high-risk vulnerabilities (CVSS v3 7 or above, or so labelled by the vendor) must go on within 14 days. That catches any Windows 10 PC left without security updates; our Windows 10 ESU guide sets out the dates.
List price. IASME's prices on 12 November 2026 were as follows.
| Organisation size | US dollars | Pounds sterling |
|---|---|---|
| 0 to 9 employees | $460 | £320 + VAT |
| 10 to 49 employees | $630 | £440 + VAT |
| 50 to 249 employees | $710 | £500 + VAT |
| 250 or more employees | $850 | £600 + VAT |
Certification bodies quote Cyber Essentials Plus by the size and complexity of your network.
Time. You have up to six months after purchase to complete the assessment, an assessor reviews answers within three working days, and the certificate is valid for 12 months.
UK extras. UK organisations with turnover under £20 million that certify the whole organisation get cyber liability insurance arranged by IASME. For the First Step Fund, IASME says UK-based micro and SME organisations that have not held Cyber Essentials in the last four years may get 75% off if they register and buy by 31 March 2027, subject to funding.
ISO/IEC 27001:2022
What it is. An international standard for an information security management system (ISMS): a risk-based process for choosing, running and improving security controls. ISO calls it the best-known ISMS standard in the world. The current edition, the third, was published on 25 October 2022.
Controls. Annex A references the controls in ISO/IEC 27002:2022, which IAF MD 26 summarises as 93 controls in four clauses (down from 114 in 14), with 11 new, 24 merged and 58 updated. You select controls through risk assessment and record them in a Statement of Applicability.
Who certifies. Not ISO. ISO states that it does not perform certification or issue certificates; external certification bodies do, and certification is optional. ISO adds that a certificate from an accredited body carries extra weight, because an accreditation body has checked the certifier. LRQA, one such body, describes accredited certification as an independent two-stage process.
Scope and price. Buyers should read the scope statement, because a narrow scope can exclude the service they buy. ISO publishes no fees; certification bodies quote by scope, headcount and sites.
Time. A certificate runs on a three-year cycle with annual surveillance audits and a recertification audit at the end, according to ISMS.online's summary of certification practice.
SOC 2
What it is. An attestation report, not a certificate. A licensed, independent CPA examines controls at a service organisation against the AICPA's Trust Services Criteria for security, availability, processing integrity, confidentiality and privacy. Security, covered by the common criteria, is always included; the other four categories are added when they match what you promise customers.
Type 1 and Type 2. A Type 1 report covers the design of controls as at one date. A Type 2 report adds the auditor's tests of how controls operated over a period: the AICPA's illustrative Type 2 report contains management's assertion, the system description, the auditor's report, and the tests of controls with results. Vendors often complete a Type 1 first while the Type 2 period runs. SOC 3 is the AICPA's general-use report.
Criteria and price. The 2017 Trust Services Criteria with revised points of focus (2022) remain in force until a final 2027 version is issued. The AICPA publishes no fee schedule; CPA firms quote by scope, categories and report type.
Quality check for buyers. The May 2026 alert tells peer reviewers to test whether SOC 2 engagement timelines are reasonable and whether each engagement is tailored to the client. Ask whether the CPA firm is licensed and peer reviewed, and whether the report reads as specific to the vendor.
What the proposed 2027 SOC 2 criteria would change
According to the AICPA announcement, the drafts consolidate duplicated concepts, remove some criteria, add others and tighten the wording. New points of focus cover AI governance, model monitoring, prompt manipulation, data poisoning, transparency of AI-generated outputs, training data management and automated decision-making. If you ship AI agents, our prompt injection guardrails guide covers several of these controls.
A-LIGN, a CPA firm that issues SOC 2 reports, published a criterion-level reading on 5 November 2026. In its summary:
- The common criteria shrink from 33 criteria across nine series (CC1 to CC9) to 20 across eight (CC1 to CC8).
- Logical and physical access becomes CC5, system operations CC6, and change management CC7, split into infrastructure, acquired software and internally developed software.
- Vendor and business-partner risk becomes CC8, and encryption becomes its own criterion.
- AI appears as points of focus under 17 criteria, not as a new category; the five categories remain.
Treat the numbering as provisional. On the proposed wording, a Type 2 engagement beginning in 2027 would use the 2017 criteria unless vendor and auditor adopt early.
Head-to-head comparison
| Cyber Essentials and Plus | ISO/IEC 27001:2022 | SOC 2 | |
|---|---|---|---|
| Owner | NCSC (UK), delivered by IASME | ISO and IEC; accreditation via Global ACI members | AICPA (US) |
| Output | Certificate, public search | Certificate from a certification body | CPA attestation report, usually shared under NDA |
| Scope | Whole organisation or defined subset; cloud cannot be excluded | Organisation-defined ISMS scope | Defined system and chosen categories |
| Control depth | 5 technical controls | Management system plus 93 Annex A controls | Common criteria plus optional categories |
| List price | $460 to $850 or £320 to £600 + VAT; Plus quoted | Not published | Not published |
| Validity | 12 months | 3-year cycle, annual surveillance | Report covers a date or a period |
| Strongest demand | UK public sector, UK supply chains | International, multinational, EU | US enterprise SaaS buyers |
| 2026 to 2027 change | Auto-fails since 27 April 2026 | 2013 certificates ended 31 October 2025 | 2027 draft, comments to 15 January 2027 |
How the controls overlap
One engineering programme can produce evidence for all three, because the technical core overlaps. The SOC 2 column uses the current 2017 numbering.
| Cyber Essentials control | ISO/IEC 27002:2022 control areas | SOC 2 (2017 criteria) |
|---|---|---|
| Firewalls | Network security | Logical and physical access (CC6) |
| Secure configuration | Configuration management | Logical access (CC6), system operations (CC7) |
| Security update management (14 days) | Management of technical vulnerabilities | System operations (CC7), change management (CC8) |
| User access control and MFA | Access control, secure authentication, privileged access | Logical and physical access (CC6) |
| Malware protection | Protection against malware | Logical and physical access (CC6) |
| Not covered | Risk assessment, supplier security, incident management, continuity | Control environment, risk assessment, monitoring (CC1 to CC4), risk mitigation (CC9) |
The last row is the real difference. Cyber Essentials tests whether specific technical controls are in place; ISO 27001 and SOC 2 test whether you govern security as a managed process, including suppliers and incidents.
Decision table: which to pick
| Pick | If |
|---|---|
| Cyber Essentials | You bid for UK central government or NHS contracts involving personal or OFFICIAL data, or a customer's supplier policy names it |
| Cyber Essentials Plus | The tender asks for it, or you want independent technical testing |
| SOC 2 Type 1 | US prospects need something within a few months while your Type 2 period runs |
| SOC 2 Type 2 | You sell SaaS or managed services to US enterprises |
| ISO/IEC 27001 | You sell to multinational or EU buyers or want a certificate rather than a report |
| None of these alone | You sell cloud services to US federal agencies (FedRAMP) or work in the US defence supply chain (CMMC) |
Worked cost example: a 40-person SaaS vendor selling in both markets
Take a 40-person UK SaaS company with UK public-sector prospects and three US enterprise deals asking for SOC 2.
Published fees. The 10 to 49 employee band for Cyber Essentials is £440 + VAT ($630). If the company has not held Cyber Essentials in the last four years and buys before 31 March 2027 while funding lasts, the First Step Fund takes 75% off: £440 × 0.25 = £110 + VAT. Cyber Essentials Plus, if a tender asks for it, is a separate quote.
Unpublished fees. For ISO 27001 and SOC 2, get at least three written quotes each and compare scope, report type and audit days.
Year-one sequence.
| Quarter | Action | Known cost or date |
|---|---|---|
| Q1 2027 | MFA on all cloud services, 14-day patch reporting, asset and vendor inventory | Engineering time |
| Q1 2027 | Cyber Essentials | £110 + VAT with First Step Fund, or £440 + VAT |
| Q2 2027 | SOC 2 Type 1, then open the Type 2 period | CPA firm quote |
| Q2 2027 | Cyber Essentials Plus if a tender requires it | Within 3 months of the basic certificate; quote |
| Q4 2027 | SOC 2 Type 2 report on the 2017 criteria | CPA firm quote |
| 2028 | ISO 27001 Stage 1 and Stage 2 if EU or multinational buyers ask | Certification body quote; 3-year cycle |
| Q1 2028 | Renew Cyber Essentials | 12-month certificate |
The saving is reuse: the MFA rollout, patch reports, access reviews and asset list built for Cyber Essentials in Q1 are the evidence a SOC 2 auditor samples later in the year.
Implementation checklist
- List what each live deal asks for. Cyber Essentials Plus, SOC 2 Type 2 and ISO 27001 certification are not interchangeable.
- Inventory cloud services and identities. Cyber Essentials fails you without MFA on each cloud service that offers it.
- Build a patch pipeline with evidence. Cyber Essentials needs 14 days for critical and high-risk updates; SOC 2 and ISO auditors ask for the same reports.
- Write the scope down early. Cyber Essentials lists legal entities, ISO needs an ISMS scope, and SOC 2 needs a system description.
- Choose SOC 2 categories deliberately. If your product makes AI-driven decisions, ask your auditor about processing integrity.
- Vet the auditor. Check CPA licensing and peer review for SOC 2, and accreditation for ISO certification bodies.
- Comment on the AICPA draft by 15 January 2027 if a proposed change would be hard to operate.
- Set renewal dates. Cyber Essentials every 12 months, ISO surveillance yearly, SOC 2 Type 2 periods back to back.
How buyers should read supplier evidence
For Cyber Essentials, use the certificate search on IASME's site, which the NCSC points to. The digital certificate now shows the scope and in-scope legal entities, so confirm the entity you contract with is listed.
For ISO 27001, check the 2022 edition, that the certification body is accredited by a member of Global ACI's recognition arrangement, and that the scope covers the service you buy.
For SOC 2, check the report type, period, categories, carved-out subservice organisations and exceptions, and ask for a bridge letter if the period ended months ago. Generic, templated wording is the warning sign the peer review guidance describes.
How eCorpIT can help
eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. We build the controls and evidence that sit under these frameworks, from MFA rollout to 14-day patch reporting, through our SOC 2 and ISO 27001 readiness engineering service, working alongside your certification body or CPA firm rather than certifying or attesting ourselves. Talk to us at /contact-us/.
Last updated: 12 November 2026.
